SC-200 Practice Exam 57 — 20 Questions

Question 1

During an incident response, a security analyst identifies that a user's account was used to access sensitive data from an anomalous location. The analyst needs to immediately prevent further access from that account while preserving forensic data. Which action should the analyst take?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID stops access immediately and preserves data. Option A only revokes sessions; Option C is too broad; Option D affects all users.

Answer

Revoke the user's current sessions in Microsoft Entra ID.

Answer

Block the IP address of the anomalous location in the firewall.

Answer

Enable multi-factor authentication (MFA) for the user.

Question 2

Which TWO of the following are valid methods to retrieve data from Microsoft Sentinel for external analysis during an incident?

Accepted Answer

Connect Log Analytics workspace to external tools via API.. Export data to Log Analytics workspace for external querying and use the Microsoft Sentinel API to programmatically access data. Option A is not a standard method; Option D is for management; Option E is for visualization.

Answer

Use Microsoft Sentinel PowerShell cmdlets.

Answer

Create a Power BI dashboard.

Answer

Use the Export to CSV feature in the Logs blade.

Question 3

A company uses Microsoft Sentinel with Microsoft Defender for Cloud Apps. An incident is created when a user downloads 500 GB from SharePoint in one hour. The analyst wants to create a playbook that automatically suspends the user in Microsoft Entra ID when such activity is detected. Which connector and action should the analyst use in the playbook?

Accepted Answer

Microsoft Entra ID connector with 'Update user' action to set accountEnabled to false.. Option C is correct because the Microsoft Entra ID connector can update user settings, and the action to disable account is available. Option A is wrong because Defender for Cloud Apps connector does not directly disable users. Option B is wrong because Exchange Online is for mailboxes. Option D is wrong because Microsoft Teams is for communication.

Answer

Microsoft Teams connector with 'Post message' action to notify admin.

Answer

Microsoft 365 Defender connector with 'Run advanced hunting' action.

Answer

Exchange Online connector with 'Set mailbox' action.

Question 4

Refer to the exhibit. You are investigating incidents related to suspicious process injection. The KQL query above is run in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

To get a count of 'Suspicious process injection' alerts grouped by compromised entity and severity, sorted by count. The correct answer is C because the query summarizes alerts by compromised entity and severity, then orders by count. Option A is wrong because it does not show all alerts. Option B is wrong because it does not filter by time. Option D is wrong because it does not list all entities.

Answer

To find alerts that occurred within a specific time range

Answer

To list all alerts of type 'Suspicious process injection' in the last 7 days

Answer

To identify the compromised entities with the highest severity alerts

Question 5

Refer to the exhibit. This is a snippet from an automation rule in Microsoft Sentinel. What is the purpose of the 'RunQuery' action?

Accepted Answer

To retrieve sign-in logs for the user involved in the incident.. Option B is correct. The action runs a KQL query using the UserPrincipalName from the incident's entities (the user involved) to pull sign-in logs for further investigation. Option A is wrong because playbooks, not automation rules, run Logic Apps. Option C is wrong because 'RunQuery' does not update the incident. Option D is wrong because the query is KQL, not a PowerShell script.

Answer

To automatically update the incident status to 'Active'.

Answer

To run a PowerShell script on the affected endpoint.

Answer

To trigger a playbook that isolates the user's device.

Question 6

Your organization uses Microsoft Sentinel. An incident is created from a fusion detection that combines multiple signals. You need to ensure that when the incident is resolved, all related alerts are also resolved automatically. What should you do?

Accepted Answer

Create an automation rule triggered when an incident is closed, with the action 'Close alert'. Option D is correct because the 'Close incident' automation rule with a condition 'Alert was closed' causes alerts to close when the incident closes. Option A is wrong because analytics rules do not control alert closure on incident resolution. Option B is wrong because playbooks triggered on incident creation would not run on closure. Option C is wrong because automation rules triggered on alert creation do not handle incident closure.

Answer

Create a playbook triggered on incident creation that closes alerts

Answer

Create an automation rule triggered when an alert is created

Answer

Configure the analytics rule to close alerts when the incident is resolved

Question 7

Refer to the exhibit. You are configuring an analytics rule in Microsoft Sentinel. What is the effect of this configuration?

Accepted Answer

Alerts that share all the same entities are grouped into one incident within 5 hours. Option D is correct because grouping with matchingMethod 'AllEntities' groups alerts that share all entities (like IP, host, user) into a single incident within a 5-hour lookback. Option A is wrong because it does not create incidents per entity. Option B is wrong because it does not create an incident for each alert. Option C is wrong because it does not create an incident per alert type.

Answer

All alerts that share any entity are grouped into one incident

Answer

Each alert creates a separate incident

Answer

Alerts are grouped by alert type

Question 8

You are investigating a lateral movement incident in Microsoft Defender for Endpoint. The timeline shows that a user's credentials were used from a compromised workstation to access a sensitive server. Which action should you take to contain the incident?

Accepted Answer

Reset the compromised user's password and revoke all active sessions.. Resetting the compromised user's password and revoking sessions is the most effective way to stop lateral movement because it invalidates the stolen credentials. Isolating the workstation is necessary but does not stop credential reuse. Disabling the server account is too broad. Blocking network traffic may not be feasible.

Answer

Disable the sensitive server's network account.

Answer

Isolate the compromised workstation only.

Answer

Block all network traffic from the compromised workstation to the server.

Question 9

Your organization is using Microsoft Defender for Cloud to protect Azure workloads. A critical vulnerability was discovered in a virtual machine that is part of a production application. The vulnerability has a high severity score and is actively being exploited in the wild. You need to respond quickly to mitigate the risk. What is the most effective immediate action?

Accepted Answer

Enable just-in-time (JIT) VM access in Microsoft Defender for Cloud to lock down inbound traffic.. Enabling just-in-time (JIT) VM access reduces the attack surface by restricting inbound traffic to the VM, providing immediate protection. Option A is incorrect because patching may take time and could disrupt operations. Option B is incorrect because network security groups (NSGs) are already in place and changing rules may not address the vulnerability directly. Option D is incorrect because Defender for Cloud does not have automatic patching; it only recommends.

Answer

Apply the vendor patch immediately during business hours.

Answer

Modify the network security group (NSG) to block all inbound traffic to the VM.

Answer

Use the 'Remediate' option in Defender for Cloud to automatically apply the patch.

Question 10

Refer to the exhibit. The KQL query is used in a Microsoft Sentinel scheduled alert rule. What scenario does this query detect?

Accepted Answer

Attempts to sign in with disabled user accounts.. Option C is correct. ResultType 50057 indicates user account is disabled (or other reason for rejection). The query counts failed sign-ins due to disabled accounts, which can indicate an attacker trying to use a disabled account. Option A is not specific to disabled accounts. Option B is about MFA, not 50057. Option D is about IP brute force, but the result type is specific.

Answer

Multiple MFA denial events from a single user.

Answer

Brute force attacks against Azure AD accounts using invalid passwords.

Answer

Brute force attacks from a single IP address against multiple accounts.

Question 11

During an incident response, you need to collect a forensic image of a Windows 10 device managed by Microsoft Intune. Which Microsoft Defender XDR feature should you use?

Accepted Answer

Microsoft Defender for Endpoint Live Response. Option B is correct because Microsoft Defender for Endpoint's Live Response allows you to collect forensic data from devices. Option A is wrong because Microsoft Purview eDiscovery is for content search and legal hold. Option C is wrong because Microsoft Defender for Cloud Apps is for cloud app security. Option D is wrong because Microsoft Sentinel is a SIEM, not for live forensic collection.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Sentinel

Question 12

Which TWO are valid incident classification categories in Microsoft Sentinel?

Accepted Answer

True positive. Options B and D are correct. 'False positive' and 'True positive' are standard classification categories. Option A is wrong because 'Informational' is not a classification category. Option C is wrong because 'Benign positive' is not a standard category. Option E is wrong because 'Unknown' is not a classification category.

Answer

Benign positive

Answer

Unknown

Answer

Informational

Question 13

A Microsoft Defender for Endpoint alert indicates that a device has been communicating with a known command-and-control (C2) server. The device is critical for production. What is the most appropriate response?

Accepted Answer

Isolate the device using Microsoft Defender for Endpoint's device isolation feature.. The most appropriate response is to isolate the device from the network to prevent further C2 communication while preserving forensic data. Disconnecting the network cable does not preserve data. Running a full scan is reactive. Blocking the C2 URL is less effective because the device may have other backdoors.

Answer

Disconnect the network cable of the device.

Answer

Run a full antivirus scan on the device.

Answer

Block the C2 server URL in the firewall.

Question 14

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was automatically created for a sign-in from an unfamiliar location, but after investigation, it was determined to be a false positive. You need to reduce similar false positives in the future without affecting legitimate detections. What should you do?

Accepted Answer

Modify the analytics rule query to exclude sign-ins from the specific location.. Using an analytics rule with a KQL query allows you to add specific conditions to filter out false positives while maintaining detection capabilities. Option A is incorrect because turning off analytics rules disables all detections. Option C is incorrect because automation rules act after detection. Option D is incorrect because watchlists are for reference, not direct filtering.

Answer

Disable the analytics rule that created the incident.

Answer

Add the location to a watchlist and reference it in the analytics rule.

Answer

Create an automation rule to close similar incidents automatically.

Question 15

Your organization uses Microsoft Defender XDR. You receive an alert about a potentially unwanted application (PUA) being installed on a device. The PUA is not blocked by your current policy. You need to prevent future installations of this PUA without affecting other software. What should you do?

Accepted Answer

Create a custom indicator of compromise (IoC) to block the specific file's hash.. Adding the file's SHA-256 hash to the custom indicator allows Defender to block it specifically. Option A is incorrect because blocking all PUAs is too broad. Option C is incorrect because a full scan does not prevent future installations. Option D is incorrect because resetting the device is excessive.

Answer

Enable blocking of all potentially unwanted applications in the antivirus policy.

Answer

Reset the device to its factory settings.

Answer

Run a full scan on the device to remove the PUA.

Question 16

Your organization's Microsoft Sentinel workspace ingests logs from multiple regions. During an incident, you need to search for a specific user's activity across all workspaces in a single query. What is the most efficient way to accomplish this?

Accepted Answer

Use a cross-workspace query with the workspace() expression.. A cross-workspace query using the workspace() expression allows querying multiple workspaces in one KQL query. Option B is manual; Option C is for search; Option D is for analytics.

Answer

Run separate queries in each workspace and combine results manually.

Answer

Create a new analytics rule that queries all workspaces.

Answer

Use the Microsoft Sentinel search feature with the workspace filter.

Question 17

The analyst notices that the rule does not fire for a user who has 12 sign-ins from the same IP address, but all are low risk. The expected behavior is to alert when a single user has more than 10 sign-ins from the same IP with at least one high-risk sign-in. What is the issue?

Accepted Answer

The query requires a high-risk sign-in from the same IP, but none exist, so no match.. Option D is correct. The join requires high-risk sign-ins from the same IP, but the threshold only applies to the first aggregation. If all sign-ins are low risk, no high-risk join match occurs. Option A is wrong because the threshold is 10. Option B is wrong because the join is inner, which filters out non-matching. Option C is wrong because the join is on both fields.

Answer

The join should be on UserPrincipalName only, not IPAddress.

Answer

The join should be leftouter to include sign-ins without high risk.

Answer

The threshold is set to 10, but the user has 12 sign-ins, so it should fire.

Question 18

Which TWO playbook actions can be used to automatically contain a compromised user account in Microsoft Entra ID during an incident? (Choose TWO.)

Accepted Answer

Disable the user account via Microsoft Graph API.. Option A is correct because disabling the account is a containment action. Option C is correct because revoking sessions ensures the attacker loses access. Option B is wrong because it does not prevent login. Option D is wrong because it is not containment. Option E is wrong because it is not containment.

Answer

Reset the user's password.

Answer

Send a notification email to the user.

Answer

Add the user to a group that has access to critical resources.

Question 19

You are responding to an incident where a user's credentials were stolen via a phishing email. The attacker used the credentials to access Microsoft Entra ID and then tried to perform privileged role escalation. Which Microsoft Sentinel solution should you use to detect this type of attack?

Accepted Answer

UEBA (User and Entity Behavior Analytics). Option D is correct. UEBA analytics in Microsoft Sentinel can detect anomalous behavior like role escalation attempts after credential theft. Option A (Syslog) is for generic log collection. Option B (Threat Intelligence) is for known indicators. Option C (Network Security Groups) is for network traffic.

Answer

Network Security Group flow logs

Answer

Syslog data connector

Answer

Threat intelligence connectors

Question 20

Which TWO actions should you take when responding to a confirmed ransomware incident in Microsoft Defender XDR?

Accepted Answer

Run a full antivirus scan. Options B and D are correct. Isolating affected devices prevents spread, and running a full antivirus scan helps remove malware. Option A is wrong because resetting passwords is not immediate containment. Option C is wrong because disabling the account might not be necessary and could hinder investigation. Option E is wrong because restoring files from backup is a recovery step after containment.

Answer

Reset the user's password

Answer

Restore files from backup

Answer

Disable the user account